Extracted

• • Target

    75e59c17a1b56a7a68b87110df188b4c_JaffaCakes118

  • Size

    117KB

  • MD5

    75e59c17a1b56a7a68b87110df188b4c

  • SHA1

    d332dd0637b6070d2d9a5e52667d8178e80164dd

  • SHA256

    c3a5b5451426106bdf857dca1f6c56f6fa8607d1c682c676f50db752acd4aab2

  • SHA512

    f4dcf6aef9eaf37c4cce6a8725c058b1c25d6dec120cdbfef0409e62fa856c2e87b224b5c8389dde0ed8702abff5cb698f90a5cb1d32bf7c9f231016be4bd588

  • SSDEEP

    1536:dReaCi4LtqlqHrwr2zST+T/e8pDYJ0TFsII2jENAgEUYrXk:dReaCi4JMr4ST+T/dJDsIIKvgEtk

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2